Living Dangerously with Claude (simonwillison.net)

At a Claude Code Anonymous meetup the author described the trade-off they’ve been wrestling with: running Claude Code with the flag --dangerously-skip-permissions (nicknamed “YOLO mode”) dramatically increases productivity by letting agents run unattended and finish complex side projects—examples include getting DeepSeek-OCR running on an NVIDIA Spark, using Pyodide in Node.js from an iPhone-launched task, and compiling 20‑year‑old Perl+C SLOCCount into a browser WebAssembly app. These demos show how hands-off coding agents can parallelize curiosity-driven research and solve messy engineering problems with minimal human supervision. The flip side is security: YOLO mode amplifies prompt injection risks and what the author calls the “lethal trifecta” — private data + untrusted content + external communication — which enables straightforward data exfiltration (e.g., a crafted env.html that tricks an agent into sending secrets to an attacker). Practical mitigations: strict sandboxing that controls filesystem access and, crucially, network allow‑listing to block outbound channels. On macOS the author points to sandbox-exec and Anthropic’s HTTP‑proxy allowlist pattern as practical controls, but notes sandbox-exec is deprecated and that robust, remote sandboxes or network-restricted environments are essential if you run YOLO agents over sensitive code or secrets. The takeaway: YOLO mode is powerful, but only safe when paired with careful isolation and network controls.